How severe is CVE-2026-49344?

CVE-2026-49344 has a CVSS 4.0 base score of 7.1, rated high severity.

Is CVE-2026-49344 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-49344?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-49344 have an EU (EUVD) identifier?

Yes. CVE-2026-49344 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38071.

When was CVE-2026-49344 published?

CVE-2026-49344 was published on 2026-06-19 and last updated on 2026-06-23.

CVE-2026-49344

CVE-2026-49344 is a high-severity vulnerability with a CVSS 4.0 base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-359.

Key facts

Severity: High (CVSS 4.0 base score 7.1)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38071
Weakness: CWE-359
Published: 2026-06-19
Last modified: 2026-06-23

Description

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.

Frequently asked questions

What is CVE-2026-49344?: Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.
How severe is CVE-2026-49344?: CVE-2026-49344 has a CVSS 4.0 base score of 7.1, rated high severity.
Is CVE-2026-49344 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-49344?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-49344 have an EU (EUVD) identifier?: Yes. CVE-2026-49344 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38071.
When was CVE-2026-49344 published?: CVE-2026-49344 was published on 2026-06-19 and last updated on 2026-06-23.

References

https://github.com/sourcentis/mercator/security/advisories/GHSA-q3r8-3h7c-96w3

Other CWE-359 vulnerabilities

CVE-2022-0482 — Critical (CVSS 9.1): Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments…
CVE-2022-2921 — High (CVSS 8.8): Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to…
CVE-2025-53625 — High (CVSS 8.7): The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with…
CVE-2025-13008 — High (CVSS 8.6): An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and…
CVE-2023-36052 — High (CVSS 8.6): Azure CLI REST Command Information Disclosure Vulnerability
CVE-2024-26192 — High (CVSS 8.2): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Browse all CWE-359 vulnerabilities →